Killing CORS Preflight Requests on a React SPA
Damon Aw
1187
Thanks for your article, I had the same issue and found another clever idea in a stack overflow answer.
It uses an iframe that loads a dummy page on the API server. All the requests can then use this iframe (either to create some `XMLHttpRequest`s or to invoke `fetch`).
This way you can use any method and content-type to communicate with your API without proxying and you’ll never see any preflight request again. You just have to cope with an additional iframe floating somewhere in the DOM (and a tiny additional request at page load).